<!DOCTYPE html>
<html lang="en-us">
<head><head>
    <meta name="referrer" content="no-referrer"/>
    <meta name="google-site-verification" content="9vIieCe-Qpd78QOmBl63rGtIVbhY6sYyuxX3j8XWBA4" />
    <meta name="baidu-site-verification" content="LRrmH41lz7" />
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="google-site-verification" content="xBT4GhYoi5qRD5tr338pgPM5OWHHIDR6mNg1a3euekI" />
    <meta name="viewport" content="width=device-width, initial-scale=1">
    
    <meta name="description" content="runC工具创建容器实战">
    
    <meta name="keyword"  content="暴走的初号机, shinji3887, 暴走的初号机的网络日志, 暴走的初号机的博客, shinji3887 Blog, 博客, 个人网站, 互联网, Web, 云原生, PaaS, Istio, Kubernetes, 微服务, Microservice">
    <link rel="shortcut icon" href="/img/favicon.ico">

    <title>使用runC创建容器-同步率400%</title>

    <link rel="canonical" href="/post/use-runc-to-create-container/">

    <link rel="stylesheet" href="https://lupeier.cn-sh2.ufileos.com/iDisqus.min.css"/>
	
    
    <link rel="stylesheet" href="https://lupeier.cn-sh2.ufileos.com/bootstrap.min.css">

    
    <link rel="stylesheet" href="https://lupeier.cn-sh2.ufileos.com/hux-blog.min.css">

    
    <link rel="stylesheet" href="https://lupeier.cn-sh2.ufileos.com/syntax.css">

    
    <link rel="stylesheet" href="https://lupeier.cn-sh2.ufileos.com/zanshang.css">

    
    <link href="/css/font-awesome.min.css" rel="stylesheet" type="text/css">
    
    
    <script src="https://lupeier.cn-sh2.ufileos.com/jquery.min.js"></script>
    
    
    <script src="https://lupeier.cn-sh2.ufileos.com/bootstrap.min.js"></script>
    
    
    <script src="https://lupeier.cn-sh2.ufileos.com/hux-blog.min.js"></script>
</head>
</head>

<nav class="navbar navbar-default navbar-custom navbar-fixed-top">
    <div class="container-fluid">
        
        <div class="navbar-header page-scroll">
            <button type="button" class="navbar-toggle">
                <span class="sr-only">Toggle navigation</span>
                <span class="icon-bar"></span>
                <span class="icon-bar"></span>
                <span class="icon-bar"></span>
            </button>
            <a class="navbar-brand" href="/">L&#39;s Blog</a>
        </div>

        
        
        <div id="huxblog_navbar">
            <div class="navbar-collapse">
                <ul class="nav navbar-nav navbar-right">
                    <li>
                        <a href="/">Home</a>
                    </li>
                    
                    <li>
                        <a href="categories/tech">tech</a>
                    </li>
                    
                    <li>
                        <a href="categories/tips">tips</a>
                    </li>
                    
                    <li>
                        <a href="/about">About</a>
                    </li>
                    
                </ul>
            </div>
        </div>
        
    </div>
    
</nav>
<script>
    
    
    
    var $body   = document.body;
    var $toggle = document.querySelector('.navbar-toggle');
    var $navbar = document.querySelector('#huxblog_navbar');
    var $collapse = document.querySelector('.navbar-collapse');

    $toggle.addEventListener('click', handleMagic)
    function handleMagic(e){
        if ($navbar.className.indexOf('in') > 0) {
        
            $navbar.className = " ";
            
            setTimeout(function(){
                
                if($navbar.className.indexOf('in') < 0) {
                    $collapse.style.height = "0px"
                }
            },400)
        }else{
        
            $collapse.style.height = "auto"
            $navbar.className += " in";
        }
    }
</script>




<style type="text/css">
    header.intro-header{
        background-image: url('https://lupeier.cn-sh2.ufileos.com/back-view-boy-child-2495567.jpg')
    }
</style>
<header class="intro-header" >
    <div class="container">
        <div class="row">
            <div class="col-lg-8 col-lg-offset-2 col-md-10 col-md-offset-1">
                <div class="post-heading">
                    <div class="tags">
                       
                       <a class="tag" href="/tags/docker" title="Docker">
                           Docker
                        </a>
                        
                       <a class="tag" href="/tags/kubernetes" title="Kubernetes">
                           Kubernetes
                        </a>
                        
                    </div>
                    <h1>使用runC创建容器</h1>
                    <h2 class="subheading"></h2>
                    <span  class="meta">Posted by L&#39; on Friday, January 11, 2019
                        
                    </span>
					<br>
                </div>
            </div>
        </div>
    </div>
</header>




<article>
    <div class="container">
        <div class="row">

            
            <div class="
                col-lg-8 col-lg-offset-2
                col-md-10 col-md-offset-1
                post-container">

        		
                        <header>
                        <h2>TOC</h2>
                        </header>
                        <nav id="TableOfContents"></nav>
        		
        		<blockquote>
<p>上一篇文章中写道了docker的底层是使用runC来管理镜像的创建，启动，监控及删除的，这次就来看一下如何使用runC工具来管理镜像的生命周期</p>
</blockquote>
<p>runC的使用非常简单，首先去github下载已经编译好的二进制文件（写文章的时候版本是1.0-rc6），文件名一般为runc.amd64，直接拷贝进usr/bin目录即可。先执行一下runc命令，有如下显示</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">NAME:
   runc - Open Container Initiative runtime

runc is a command line client <span style="color:#66d9ef">for</span> running applications packaged according to
the Open Container Initiative <span style="color:#f92672">(</span>OCI<span style="color:#f92672">)</span> format and is a compliant implementation of the
Open Container Initiative specification.

runc integrates well with existing process supervisors to provide a production
container runtime environment <span style="color:#66d9ef">for</span> applications. It can be used with your
existing process monitoring tools and the container will be spawned as a
direct child of the process supervisor.

Containers are configured using bundles. A bundle <span style="color:#66d9ef">for</span> a container is a directory
that includes a specification file named <span style="color:#e6db74">&#34;config.json&#34;</span> and a root filesystem.
The root filesystem contains the contents of the container.

To start a new instance of a container:

    <span style="color:#75715e"># runc run [ -b bundle ] &lt;container-id&gt;</span>

Where <span style="color:#e6db74">&#34;&lt;container-id&gt;&#34;</span> is your name <span style="color:#66d9ef">for</span> the instance of the container that you
are starting. The name you provide <span style="color:#66d9ef">for</span> the container instance must be unique on
your host. Providing the bundle directory using <span style="color:#e6db74">&#34;-b&#34;</span> is optional. The default
value <span style="color:#66d9ef">for</span> <span style="color:#e6db74">&#34;bundle&#34;</span> is the current directory.

USAGE:
   runc <span style="color:#f92672">[</span>global options<span style="color:#f92672">]</span> command <span style="color:#f92672">[</span>command options<span style="color:#f92672">]</span> <span style="color:#f92672">[</span>arguments...<span style="color:#f92672">]</span>
   
VERSION:
   1.0.0-rc6
spec: 1.0.1-dev
   
COMMANDS:
     checkpoint  checkpoint a running container
     create      create a container
     delete      delete any resources held by the container often used with detached container
     events      display container events such as OOM notifications, cpu, memory, and IO usage statistics
     exec        execute new process inside the container
     init        initialize the namespaces and launch the process <span style="color:#f92672">(</span><span style="color:#66d9ef">do</span> not call it outside of runc<span style="color:#f92672">)</span>
     kill        kill sends the specified signal <span style="color:#f92672">(</span>default: SIGTERM<span style="color:#f92672">)</span> to the container<span style="color:#e6db74">&#39;s init process
</span><span style="color:#e6db74">     list        lists containers started by runc with the given root
</span><span style="color:#e6db74">     pause       pause suspends all processes inside the container
</span><span style="color:#e6db74">     ps          ps displays the processes running inside a container
</span><span style="color:#e6db74">     restore     restore a container from a previous checkpoint
</span><span style="color:#e6db74">     resume      resumes all processes that have been previously paused
</span><span style="color:#e6db74">     run         create and run a container
</span><span style="color:#e6db74">     spec        create a new specification file
</span><span style="color:#e6db74">     start       executes the user defined process in a created container
</span><span style="color:#e6db74">     state       output the state of a container
</span><span style="color:#e6db74">     update      update container resource constraints
</span><span style="color:#e6db74">     help, h     Shows a list of commands or help for one command
</span><span style="color:#e6db74">
</span><span style="color:#e6db74">GLOBAL OPTIONS:
</span><span style="color:#e6db74">   --debug             enable debug output for logging
</span><span style="color:#e6db74">   --log value         set the log file path where internal debug information is written (default: &#34;/dev/null&#34;)
</span><span style="color:#e6db74">   --log-format value  set the format used by logs (&#39;</span>text<span style="color:#e6db74">&#39; (default), or &#39;</span>json<span style="color:#e6db74">&#39;) (default: &#34;text&#34;)
</span><span style="color:#e6db74">   --root value        root directory for storage of container state (this should be located in tmpfs) (default: &#34;/run/runc&#34;)
</span><span style="color:#e6db74">   --criu value        path to the criu binary used for checkpoint and restore (default: &#34;criu&#34;)
</span><span style="color:#e6db74">   --systemd-cgroup    enable systemd cgroup support, expects cgroupsPath to be of form &#34;slice:prefix:name&#34; for e.g. &#34;system.slice:runc:434234&#34;
</span><span style="color:#e6db74">   --rootless value    ignore cgroup permission errors (&#39;</span>true<span style="color:#e6db74">&#39;, &#39;</span>false<span style="color:#e6db74">&#39;, or &#39;</span>auto<span style="color:#960050;background-color:#1e0010">&#39;</span><span style="color:#f92672">)</span> <span style="color:#f92672">(</span>default: <span style="color:#e6db74">&#34;auto&#34;</span><span style="color:#f92672">)</span>
   --help, -h          show help
   --version, -v       print the version
</code></pre></div><p>简单的说，runC是一个命令行工具，用来运行按照OCI标准格式打包过的应用，容器使用bundle进行配置。bundle的概念，简单来说就是一个目录，目录里包含一个配置文件<code>config.son</code>和一个root文件系统（rootfs目录），使用命令</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash"><span style="color:#75715e"># runc run [ -b bundle ] &lt;container-id&gt;</span>
</code></pre></div><p>来启动一个容器，其中<code>-b</code>是可选项，用来指定bundle的位置（默认为当前目录），注意<code>container-id</code>必须在host上唯一。</p>
<p>因为需要制作root filesystem，所以还需要安装好docker并设置好镜像仓库（这步不是必须的，理论上只要你制作出一个符合OCI规范的filesystem都可以，只是自己弄比较麻烦）</p>
<p>准备工作都完成后，接下来就可以开始测试了</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash"><span style="color:#75715e"># create the top most bundle directory</span>
mkdir /mycontainer
cd /mycontainer

<span style="color:#75715e"># create the rootfs directory</span>
mkdir rootfs

<span style="color:#75715e"># export busybox via Docker into the rootfs directory</span>
docker export <span style="color:#66d9ef">$(</span>docker create busybox<span style="color:#66d9ef">)</span> | tar -C rootfs -xvf -
</code></pre></div><p>这几步是先创建容器目录，再创建一个名字叫rootfs的目录，之后使用一个docker的镜像busybox（一个轻量级的linux工具集）来制作root filesystem(docker镜像都是符合OCI格式规范的)。完成后rootfs目录下会有如下文件</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash"><span style="color:#f92672">[</span>root@localhost rootfs<span style="color:#f92672">]</span><span style="color:#75715e"># ls -l</span>
总用量 <span style="color:#ae81ff">16</span>
drwxr-xr-x. <span style="color:#ae81ff">2</span> root      root      <span style="color:#ae81ff">12288</span> 1月   <span style="color:#ae81ff">1</span> 02:16 bin
drwxr-xr-x. <span style="color:#ae81ff">4</span> root      root         <span style="color:#ae81ff">43</span> 1月  <span style="color:#ae81ff">11</span> 09:20 dev
drwxr-xr-x. <span style="color:#ae81ff">3</span> root      root        <span style="color:#ae81ff">139</span> 1月  <span style="color:#ae81ff">11</span> 09:20 etc
drwxr-xr-x. <span style="color:#ae81ff">2</span> nfsnobody nfsnobody     <span style="color:#ae81ff">6</span> 1月   <span style="color:#ae81ff">1</span> 02:16 home
drwxr-xr-x. <span style="color:#ae81ff">2</span> root      root          <span style="color:#ae81ff">6</span> 1月  <span style="color:#ae81ff">11</span> 09:20 proc
drwx------. <span style="color:#ae81ff">2</span> root      root          <span style="color:#ae81ff">6</span> 1月   <span style="color:#ae81ff">1</span> 02:16 root
drwxr-xr-x. <span style="color:#ae81ff">2</span> root      root          <span style="color:#ae81ff">6</span> 1月  <span style="color:#ae81ff">11</span> 09:20 sys
drwxrwxrwt. <span style="color:#ae81ff">2</span> root      root          <span style="color:#ae81ff">6</span> 1月   <span style="color:#ae81ff">1</span> 02:16 tmp
drwxr-xr-x. <span style="color:#ae81ff">3</span> root      root         <span style="color:#ae81ff">18</span> 1月   <span style="color:#ae81ff">1</span> 02:16 usr
drwxr-xr-x. <span style="color:#ae81ff">4</span> root      root         <span style="color:#ae81ff">30</span> 1月   <span style="color:#ae81ff">1</span> 02:16 var
</code></pre></div><p>有了rootfs之后，我们就可以执行如下命令</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">runc spec
</code></pre></div><p>来创建一个<code>config.json</code>文件，这个文件是一个标准的OCI格式的文件，内容如下</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-json" data-lang="json">{
	<span style="color:#f92672">&#34;ociVersion&#34;</span>: <span style="color:#e6db74">&#34;1.0.1-dev&#34;</span>,
	<span style="color:#f92672">&#34;process&#34;</span>: {
		<span style="color:#f92672">&#34;terminal&#34;</span>: <span style="color:#66d9ef">true</span>,
		<span style="color:#f92672">&#34;user&#34;</span>: {
			<span style="color:#f92672">&#34;uid&#34;</span>: <span style="color:#ae81ff">0</span>,
			<span style="color:#f92672">&#34;gid&#34;</span>: <span style="color:#ae81ff">0</span>
		},
		<span style="color:#f92672">&#34;args&#34;</span>: [
			<span style="color:#e6db74">&#34;sh&#34;</span>
		],
		<span style="color:#f92672">&#34;env&#34;</span>: [
			<span style="color:#e6db74">&#34;PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin&#34;</span>,
			<span style="color:#e6db74">&#34;TERM=xterm&#34;</span>
		],
		<span style="color:#f92672">&#34;cwd&#34;</span>: <span style="color:#e6db74">&#34;/&#34;</span>,
		<span style="color:#f92672">&#34;capabilities&#34;</span>: {
			<span style="color:#f92672">&#34;bounding&#34;</span>: [
				<span style="color:#e6db74">&#34;CAP_AUDIT_WRITE&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_KILL&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_NET_BIND_SERVICE&#34;</span>
			],
			<span style="color:#f92672">&#34;effective&#34;</span>: [
				<span style="color:#e6db74">&#34;CAP_AUDIT_WRITE&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_KILL&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_NET_BIND_SERVICE&#34;</span>
			],
			<span style="color:#f92672">&#34;inheritable&#34;</span>: [
				<span style="color:#e6db74">&#34;CAP_AUDIT_WRITE&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_KILL&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_NET_BIND_SERVICE&#34;</span>
			],
			<span style="color:#f92672">&#34;permitted&#34;</span>: [
				<span style="color:#e6db74">&#34;CAP_AUDIT_WRITE&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_KILL&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_NET_BIND_SERVICE&#34;</span>
			],
			<span style="color:#f92672">&#34;ambient&#34;</span>: [
				<span style="color:#e6db74">&#34;CAP_AUDIT_WRITE&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_KILL&#34;</span>,
				<span style="color:#e6db74">&#34;CAP_NET_BIND_SERVICE&#34;</span>
			]
		},
		<span style="color:#f92672">&#34;rlimits&#34;</span>: [
			{
				<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;RLIMIT_NOFILE&#34;</span>,
				<span style="color:#f92672">&#34;hard&#34;</span>: <span style="color:#ae81ff">1024</span>,
				<span style="color:#f92672">&#34;soft&#34;</span>: <span style="color:#ae81ff">1024</span>
			}
		],
		<span style="color:#f92672">&#34;noNewPrivileges&#34;</span>: <span style="color:#66d9ef">true</span>
	},
	<span style="color:#f92672">&#34;root&#34;</span>: {
		<span style="color:#f92672">&#34;path&#34;</span>: <span style="color:#e6db74">&#34;rootfs&#34;</span>,
		<span style="color:#f92672">&#34;readonly&#34;</span>: <span style="color:#66d9ef">true</span>
	},
	<span style="color:#f92672">&#34;hostname&#34;</span>: <span style="color:#e6db74">&#34;runc&#34;</span>,
	<span style="color:#f92672">&#34;mounts&#34;</span>: [
		{
			<span style="color:#f92672">&#34;destination&#34;</span>: <span style="color:#e6db74">&#34;/proc&#34;</span>,
			<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;proc&#34;</span>,
			<span style="color:#f92672">&#34;source&#34;</span>: <span style="color:#e6db74">&#34;proc&#34;</span>
		},
		{
			<span style="color:#f92672">&#34;destination&#34;</span>: <span style="color:#e6db74">&#34;/dev&#34;</span>,
			<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tmpfs&#34;</span>,
			<span style="color:#f92672">&#34;source&#34;</span>: <span style="color:#e6db74">&#34;tmpfs&#34;</span>,
			<span style="color:#f92672">&#34;options&#34;</span>: [
				<span style="color:#e6db74">&#34;nosuid&#34;</span>,
				<span style="color:#e6db74">&#34;strictatime&#34;</span>,
				<span style="color:#e6db74">&#34;mode=755&#34;</span>,
				<span style="color:#e6db74">&#34;size=65536k&#34;</span>
			]
		},
		{
			<span style="color:#f92672">&#34;destination&#34;</span>: <span style="color:#e6db74">&#34;/dev/pts&#34;</span>,
			<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;devpts&#34;</span>,
			<span style="color:#f92672">&#34;source&#34;</span>: <span style="color:#e6db74">&#34;devpts&#34;</span>,
			<span style="color:#f92672">&#34;options&#34;</span>: [
				<span style="color:#e6db74">&#34;nosuid&#34;</span>,
				<span style="color:#e6db74">&#34;noexec&#34;</span>,
				<span style="color:#e6db74">&#34;newinstance&#34;</span>,
				<span style="color:#e6db74">&#34;ptmxmode=0666&#34;</span>,
				<span style="color:#e6db74">&#34;mode=0620&#34;</span>,
				<span style="color:#e6db74">&#34;gid=5&#34;</span>
			]
		},
		{
			<span style="color:#f92672">&#34;destination&#34;</span>: <span style="color:#e6db74">&#34;/dev/shm&#34;</span>,
			<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;tmpfs&#34;</span>,
			<span style="color:#f92672">&#34;source&#34;</span>: <span style="color:#e6db74">&#34;shm&#34;</span>,
			<span style="color:#f92672">&#34;options&#34;</span>: [
				<span style="color:#e6db74">&#34;nosuid&#34;</span>,
				<span style="color:#e6db74">&#34;noexec&#34;</span>,
				<span style="color:#e6db74">&#34;nodev&#34;</span>,
				<span style="color:#e6db74">&#34;mode=1777&#34;</span>,
				<span style="color:#e6db74">&#34;size=65536k&#34;</span>
			]
		},
		{
			<span style="color:#f92672">&#34;destination&#34;</span>: <span style="color:#e6db74">&#34;/dev/mqueue&#34;</span>,
			<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;mqueue&#34;</span>,
			<span style="color:#f92672">&#34;source&#34;</span>: <span style="color:#e6db74">&#34;mqueue&#34;</span>,
			<span style="color:#f92672">&#34;options&#34;</span>: [
				<span style="color:#e6db74">&#34;nosuid&#34;</span>,
				<span style="color:#e6db74">&#34;noexec&#34;</span>,
				<span style="color:#e6db74">&#34;nodev&#34;</span>
			]
		},
		{
			<span style="color:#f92672">&#34;destination&#34;</span>: <span style="color:#e6db74">&#34;/sys&#34;</span>,
			<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;sysfs&#34;</span>,
			<span style="color:#f92672">&#34;source&#34;</span>: <span style="color:#e6db74">&#34;sysfs&#34;</span>,
			<span style="color:#f92672">&#34;options&#34;</span>: [
				<span style="color:#e6db74">&#34;nosuid&#34;</span>,
				<span style="color:#e6db74">&#34;noexec&#34;</span>,
				<span style="color:#e6db74">&#34;nodev&#34;</span>,
				<span style="color:#e6db74">&#34;ro&#34;</span>
			]
		},
		{
			<span style="color:#f92672">&#34;destination&#34;</span>: <span style="color:#e6db74">&#34;/sys/fs/cgroup&#34;</span>,
			<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;cgroup&#34;</span>,
			<span style="color:#f92672">&#34;source&#34;</span>: <span style="color:#e6db74">&#34;cgroup&#34;</span>,
			<span style="color:#f92672">&#34;options&#34;</span>: [
				<span style="color:#e6db74">&#34;nosuid&#34;</span>,
				<span style="color:#e6db74">&#34;noexec&#34;</span>,
				<span style="color:#e6db74">&#34;nodev&#34;</span>,
				<span style="color:#e6db74">&#34;relatime&#34;</span>,
				<span style="color:#e6db74">&#34;ro&#34;</span>
			]
		}
	],
	<span style="color:#f92672">&#34;linux&#34;</span>: {
		<span style="color:#f92672">&#34;resources&#34;</span>: {
			<span style="color:#f92672">&#34;devices&#34;</span>: [
				{
					<span style="color:#f92672">&#34;allow&#34;</span>: <span style="color:#66d9ef">false</span>,
					<span style="color:#f92672">&#34;access&#34;</span>: <span style="color:#e6db74">&#34;rwm&#34;</span>
				}
			]
		},
		<span style="color:#f92672">&#34;namespaces&#34;</span>: [
			{
				<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;pid&#34;</span>
			},
			{
				<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;network&#34;</span>
			},
			{
				<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;ipc&#34;</span>
			},
			{
				<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;uts&#34;</span>
			},
			{
				<span style="color:#f92672">&#34;type&#34;</span>: <span style="color:#e6db74">&#34;mount&#34;</span>
			}
		],
		<span style="color:#f92672">&#34;maskedPaths&#34;</span>: [
			<span style="color:#e6db74">&#34;/proc/kcore&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/latency_stats&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/timer_list&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/timer_stats&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/sched_debug&#34;</span>,
			<span style="color:#e6db74">&#34;/sys/firmware&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/scsi&#34;</span>
		],
		<span style="color:#f92672">&#34;readonlyPaths&#34;</span>: [
			<span style="color:#e6db74">&#34;/proc/asound&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/bus&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/fs&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/irq&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/sys&#34;</span>,
			<span style="color:#e6db74">&#34;/proc/sysrq-trigger&#34;</span>
		]
	}
}
</code></pre></div><p>这边再说一下OCI规范，援引一段OCI官网的说明</p>
<blockquote>
<p>Established in June 2015 by Docker and other leaders in the container industry, the OCI currently contains two specifications: the Runtime Specification (<a href="http://www.github.com/opencontainers/runtime-spec">runtime-spec</a>) and the Image Specification (<a href="http://www.github.com/opencontainers/image-spec">image-spec</a>). The Runtime Specification outlines how to run a “<a href="https://github.com/opencontainers/runtime-spec/blob/master/bundle.md">filesystem bundle</a>” that is unpacked on disk. At a high-level an OCI implementation would download an OCI Image then unpack that image into an OCI Runtime filesystem bundle. At this point the OCI Runtime Bundle would be run by an OCI Runtime.</p>
</blockquote>
<p>简单的说，OCI有两个规范，一个是容器运行时规范<code>runtime-spec</code>，一个是镜像格式规范<code>image-spec</code>。一个镜像，简单来说就是一个打包好的符合OCI规范的<code>filesystem bundule</code>。而bundile的话，前面介绍过，包含一个配置文件<code>config.json</code>和一个rootfs目录。</p>
<p>现在<code>rootfs</code>和<code>config.json</code>都有了，我们可以创建容器了，执行</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">runc run mycontainerid
</code></pre></div><p>创建容器，成功后会自动进入容器
这时候我们执行<code>ps</code>一下，可以看到</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">/ <span style="color:#75715e"># ps</span>
PID   USER     TIME  COMMAND
    <span style="color:#ae81ff">1</span> root      0:00 sh
    <span style="color:#ae81ff">7</span> root      0:00 ps
</code></pre></div><p>可以看到这个容器里面的1号进程就是sh那个进程，看不到其他进程，容器启动试验成功。</p>
<p>现在我们可以做容器的整个生命周期管理了</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash"><span style="color:#75715e"># run as root</span>
cd /mycontainer
runc create mycontainerid

<span style="color:#75715e"># view the container is created and in the &#34;created&#34; state</span>
runc list

<span style="color:#75715e"># start the process inside the container</span>
runc start mycontainerid

<span style="color:#75715e"># after 5 seconds view that the container has exited and is now in the stopped state</span>
runc list

<span style="color:#75715e"># now delete the container</span>
runc delete mycontainerid
</code></pre></div><p>注意在执行<code>runc create mycontainerid</code>命令时，会报错</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">cannot allocate tty <span style="color:#66d9ef">if</span> runc will detach without setting console socket
</code></pre></div><p>这是由于在<code>config.json</code>文件中的配置<code>&quot;terminal&quot;: true</code>，这个默认是true，即以终端方式启动，需要改成false。</p>

        
                
        
              <hr>
              <ul class="pager">
                  
                  <li class="previous">
                      <a href="/post/understand-contianer-concept/" data-toggle="tooltip" data-placement="top" title="深入理解容器基础概念">&larr; Previous Post</a>
                  </li>
                  
                  
                  <li class="next">
                      <a href="/post/kubeadmin-create-cluster/" data-toggle="tooltip" data-placement="top" title="使用kubeadm快速搭建单机kubernetes 1.13集群">Next Post &rarr;</a>
                  </li>
                  
              </ul>
  
              

<div id="gitalk-container"></div>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/gitalk@1/dist/gitalk.css">
<script src="https://cdn.jsdelivr.net/npm/gitalk@1/dist/gitalk.min.js"></script>
<script src="/js/md5.min.js"></script>
<script>
	const gitalk = new Gitalk({
	  clientID: 'aff2580d8cc58af83367',
	  clientSecret: '747547f5f87fcc5145b847ab76a498d7e501319f',
	  repo: 'comment',
	  owner: 'shinji3887',
	  admin: ['shinji3887'],
	  id: md5(location.pathname),      
	  distractionFreeMode: false  
	})

	gitalk.render('gitalk-container')
</script>


            </div>
            
            <div class="
                col-lg-8 col-lg-offset-2
                col-md-10 col-md-offset-1
                sidebar-container">

                
                <section>
                    <hr class="hidden-sm hidden-xs">
                    <h5><a href="/tags/">FEATURED TAGS</a></h5>
                    <div class="tags">
                     
                    
                        
                            <a href="/tags/api-gateway" title="api-gateway">
                                api-gateway
                            </a>
                        
                    
                        
                    
                        
                            <a href="/tags/cloud-native" title="cloud-native">
                                cloud-native
                            </a>
                        
                    
                        
                            <a href="/tags/devops" title="devops">
                                devops
                            </a>
                        
                    
                        
                            <a href="/tags/docker" title="docker">
                                docker
                            </a>
                        
                    
                        
                    
                        
                    
                        
                    
                        
                    
                        
                            <a href="/tags/istio" title="istio">
                                istio
                            </a>
                        
                    
                        
                    
                        
                            <a href="/tags/kubernetes" title="kubernetes">
                                kubernetes
                            </a>
                        
                    
                        
                            <a href="/tags/microservice" title="microservice">
                                microservice
                            </a>
                        
                    
                        
                    
                        
                    
                        
                    
                        
                    
                        
                            <a href="/tags/restful" title="restful">
                                restful
                            </a>
                        
                    
                        
                    
                        
                            <a href="/tags/servicemesh" title="servicemesh">
                                servicemesh
                            </a>
                        
                    
                        
                            <a href="/tags/spring-cloud" title="spring-cloud">
                                spring-cloud
                            </a>
                        
                    
                        
                            <a href="/tags/vue" title="vue">
                                vue
                            </a>
                        
                    
                        
                    
                        
                    
                    </div>
                </section>

                
                <hr>
                <h5>FRIENDS</h5>
                <ul class="list-inline">
                    
                        <li><a target="_blank" href="https://skyao.io/">小剑的博客</a></li>
                    
                        <li><a target="_blank" href="https://zhaohuabing.com/">huabing的博客</a></li>
                    
                        <li><a target="_blank" href="http://blog.didispace.com/">程序猿DD的博客</a></li>
                    
                </ul>
            </div>
        </div>
    </div>
</article>




<footer>
    <div class="container">
        <div class="row">
            <div class="col-lg-8 col-lg-offset-2 col-md-10 col-md-offset-1">
                <ul class="list-inline text-center">
                   
                   <li>
                       <a href="" rel="alternate" type="application/rss+xml" title="L&#39;s Blog" >
                           <span class="fa-stack fa-lg">
                               <i class="fa fa-circle fa-stack-2x"></i>
                               <i class="fa fa-rss fa-stack-1x fa-inverse"></i>
                           </span>
                       </a>
                   </li>
                   
                    
                    <li>
                        <a href="mailto:18016380795@163.com">
                            <span class="fa-stack fa-lg">
                                <i class="fa fa-circle fa-stack-2x"></i>
                                <i class="fa fa-envelope fa-stack-1x fa-inverse"></i>
                            </span>
                        </a>
                    </li>
		    
                    
                    
                    
                    

                    

		    
                    
                    <li>
                        <a target="_blank" href="/link%20of%20wechat%20QR%20code%20image">
                            <span class="fa-stack fa-lg">
                                <i class="fa fa-circle fa-stack-2x"></i>
                                <i class="fa fa-wechat fa-stack-1x fa-inverse"></i>
                            </span>
                        </a>
                    </li>
		    
                    
                    <li>
                        <a target="_blank" href="https://github.com/shinji3887">
                            <span class="fa-stack fa-lg">
                                <i class="fa fa-circle fa-stack-2x"></i>
                                <i class="fa fa-github fa-stack-1x fa-inverse"></i>
                            </span>
                        </a>
                    </li>
		    
                    
                    <li>
                        <a target="_blank" href="https://www.linkedin.com/in/lupeier">
                            <span class="fa-stack fa-lg">
                                <i class="fa fa-circle fa-stack-2x"></i>
                                <i class="fa fa-linkedin fa-stack-1x fa-inverse"></i>
                            </span>
                        </a>
                    </li>
		    
                </ul>
		<p class="copyright text-muted">
                    Copyright &copy; L&#39;s Blog , 2019
                    <br>
                    <br>
                    <a href="http://icp.chinaz.com/info?q=lupeier.com" target="_blank">备案号：沪ICP备19022667号-1</a>                    
                </p>
            </div>
        </div>
    </div>
</footer>



<script>
    function async(u, c) {
      var d = document, t = 'script',
          o = d.createElement(t),
          s = d.getElementsByTagName(t)[0];
      o.src = u;
      if (c) { o.addEventListener('load', function (e) { c(null, e); }, false); }
      s.parentNode.insertBefore(o, s);
    }
</script>






<script>
    
    if($('#tag_cloud').length !== 0){
        async("/js/jquery.tagcloud.js",function(){
            $.fn.tagcloud.defaults = {
                
                color: {start: '#bbbbee', end: '#0085a1'},
            };
            $('#tag_cloud a').tagcloud();
        })
    }
</script>


<script>
    async("/js/fastclick.js", function(){
        var $nav = document.querySelector("nav");
        if($nav) FastClick.attach($nav);
    })
</script>


<script>
    (function(){
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https'){
       bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
      }
      else{
      bp.src = 'http://push.zhanzhang.baidu.com/push.js';
      }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>







</body>
</html>
